Comodo release 5 new security tests [CLOSED]

Hi

Comodo developers have created a new set of security tests. The Comodo HIPS and Firewall Leak Test Suite contains five new tests that simulate a range of dangerous exploits – including Root Kits, Background Intelligent Transfer attacks and process injection attacks.

The suite is available for download here:

http://download.comodo.com/securitytests/CLT.zip (extract zip to local drive and open clt.exe )

I’ve also attached the zip file to this post

Developer Notes:

Rootkit Installation 1 - Loads a driver in via ZwSetSystemInformation API. A very old, known and effective way to install a rootkit.

Rootkit Installation 2 - Loads driver by overwriting a standard driver (beep.sys) and starting it with service control manager (e.g. Trojan.Virantix.B).

DLL Injection 1 - Injects DLL into trusted process (svchost.exe) by injecting APC on LoadLibraryExA with “dll.dll” as a param. The string “dll.dll” is not written into process memory, it’s from the ntdll.dll export table which has the same address in all processes. The APC is injected into second thread of the svchost.exe which is always in alertable state.

DLL Injection 2 - An old technique. The DLL is injected via remote thread creation in the trusted process, without using WriteProcessMemory.

BITS Hijack - Downloads a file from the internet using “Background Intelligent Transfer Service” which acts from the trusted process (svchost.exe)

The tests can be automatically run in sequence by selecting ‘Run all Tests’ or run individually. The GUI provides clear, color coded indication on whether target systems are vunerable or protected.

Please take a look at the new tests - all feedback greatly appreciated.

Paul

[attachment deleted by admin]

Am I supposed to block all, cause that’s what I did and I failed 2-4, is that right?

These tests are important tests because they test whether a rootkit can install itself or not. As we all know if your security application allows a rootkit to install itself, then you are smoke!

any half decent security application should protect you against that.

thanks
Melih

I will say now, I past all tests! :BNC

Josh

Hi,

same here. D+ Train with safe mode, test 2,3 and 4 fails. #5 just crashes the app. Of course, blocking all the D+ alerts. :-[

Same here except d+ in paranoid mode. XP SP2 x32. Crash dump attached. Will do further attempts. Let me know if more details are needed.

[attachment deleted by admin]

Sorry i was not accurate: CFP doesn’t fail, it is clt that shows error (picture attached).
Addition to previous info: no actively running apps except CFP. Issue is always reproducible: it doesn’t mater if we allow or deny debug privilege for clt.exe just after it is executed, it doesn’t mater whether we run all tests at once or one by one, it doesn’t mater whether we wait some time before block activity or if we block alert just after it appeared.

Hope this helps. Let me know if more details are needed.

[attachment deleted by admin]

Same here…
But I found out that if you allow the first servicecontroll manager alert for the rootkit2 test and block all the followings it will pass.

On the system I first ran CLT on, BITS is intentionally broken. This seemed to distress CLT, which crashed. On another system (BITS working), all was OK… but, I think there should be clear instructions on how to respond to CFPs alerts.

Yes, I agree. There should be.

Josh

I do agree also, but if the devs want to make these tests useful, the only way to proceed is to block all the requests, because if I run an unknown file that wants to obtain debug privilege for example, I will block it.

Otherwise, this program will only test the security software, but not the protection in the real world.

OK, then they probably need to state what is part of “test application” & thus needs to be allowed in order for the actual “testing” to be performed. On this thought, maybe asking for all the required privileges up-front before any tests are performed might help.

I think it also needs to be stated in a way that is not CFP specific (in order to test, and be relevant to, other security software).

Exactly right!

Regards,
Mike

I can’t download it. It does not let me hit ok. Also what do I do after I download it???

It’s a ZIP File. Extract it to your C Drive, and click the clt executable.

Josh

My setup (CFP & CAVS - which I thought were configured correctly) managed:

“Vulnerable” on Rootkit Installation 1
“Protected” on Rootkit 2
“Error” for both .dll injections
“Vulnerable” to the BITS hijack.

Are we going to see any advice from Comodo regarding ways to configure their products to protect against these threats?

Comodo, you’ve told me about the monster in the wardrobe, but not how to keep him locked in there. If you don’t help me I’m going to have nightmares and probably wet the bed. I’m sure you don’t want that to happen.

They must of released it without testing against cfp. Many firewalls are passing but a lot of them come up with error which is basically saying your firewall passed. And many are also coming up vulnerable to BITS. I highly doubt comodo would release tests their own firewall couldn’t pass so these tests seem to be ■■■■■■■ up.

BITS: The BITS vulnerability has been know about for some time. Unfortunately, BITS is a required component of Windows Updates (WU). Because of this vulnerability I, and probably many others, have disabled WU from automatically running on their systems and, for me, this included BITS itself. I used to manually turn BITS on (usually set to Manual) when I wanted to run WU, but since AutoPatcher rose from the ashes recently (with APUP) I don’t use BITS any more.

I’m boring everybody with these… BITS… since I wonder if this why some people are passing the BITS test, whilst others are not.

Oh, NOW I get it, …I think… where was I? Is this utility testing the firewall or the defence+? Because I was granting it access to execute, because I thought it was trying to “phone home”, and that I was supposed to configure my firewall to stop it.

But I am not supposed to let it execute, is that right?

I’m so very confused…

I was protected on the first, error for next 3 and vulnerable to BITS Hijack. But it is not clear at all how to respond. Should all firewall alerts be blocked?